Integration with OIDC is misbehaving #14445

@techknowlogick commented on GitHub (May 5, 2025):

@0dragosh are you able to confirm with the 1.24-RC0 that was just released?

@techknowlogick commented on GitHub (May 5, 2025): @0dragosh are you able to confirm with the 1.24-RC0 that was just released?

GiteaMirror commented

@flixman commented on GitHub (May 5, 2025):

@techknowlogick I have just given it a try, and I am getting the same error with 1.24.0-rc0-rootless. This is the log in Gitea:

2025/05/05 21:10:20 HTTPRequest [I] router: completed GET /user/oauth2/authelia for 10.42.0.1:0, 307 Temporary Redirect in 1.6ms @ auth/oauth.go:37(auth.SignInOAuth)
2025/05/05 21:10:20 routers/web/auth/oauth.go:353:handleOAuth2SignIn() [E] UpdateUser: can not delete the last admin user [uid: 1]
2025/05/05 21:10:20 HTTPRequest [I] router: completed GET /user/oauth2/authelia/callback?code=authelia_ac_rEwIj1uSvjZqwld5OXjVbhrJxucGbMmeGB_gOJTCU_c.Zed6GXiXuBERtf0P--4pYUXJNHF_ub57YXwpo2G-9WA&iss=https%3A%2F%2Fauth.test.local&scope=openid+email+profile+groups&state=cccfc51d-e073-4f3c-99da-d3ab1f6d071f for 10.42.0.1:0, 500 Internal Server Error in 231.7ms @ auth/oauth.go:76(auth.SignInOAuthCallback)

@flixman commented on GitHub (May 5, 2025): @techknowlogick I have just given it a try, and I am getting the same error with 1.24.0-rc0-rootless. This is the log in Gitea: ``` 2025/05/05 21:10:20 HTTPRequest [I] router: completed GET /user/oauth2/authelia for 10.42.0.1:0, 307 Temporary Redirect in 1.6ms @ auth/oauth.go:37(auth.SignInOAuth) 2025/05/05 21:10:20 routers/web/auth/oauth.go:353:handleOAuth2SignIn() [E] UpdateUser: can not delete the last admin user [uid: 1] 2025/05/05 21:10:20 HTTPRequest [I] router: completed GET /user/oauth2/authelia/callback?code=authelia_ac_rEwIj1uSvjZqwld5OXjVbhrJxucGbMmeGB_gOJTCU_c.Zed6GXiXuBERtf0P--4pYUXJNHF_ub57YXwpo2G-9WA&iss=https%3A%2F%2Fauth.test.local&scope=openid+email+profile+groups&state=cccfc51d-e073-4f3c-99da-d3ab1f6d071f for 10.42.0.1:0, 500 Internal Server Error in 231.7ms @ auth/oauth.go:76(auth.SignInOAuthCallback) ```

GiteaMirror commented

@flixman commented on GitHub (May 12, 2025):

I done some more tests, today and indeed seems that the group information is not passed properly. I have made sure that in the token provided by authelia there is a "groups" claim, in this case, without membership to the gitea_admin group:

I have also added the flag --group-claim-name groups to the add-oauth call, and now I am starting to log in (first user after a database wipe) with an unprivileged user... and it shows as if it was an admin :-O!

Just for the record, there is no other user in the database:

So.... what's wrong?

@flixman commented on GitHub (May 12, 2025): I done some more tests, today and indeed seems that the group information is not passed properly. I have made sure that in the token provided by authelia there is a "groups" claim, in this case, without membership to the gitea_admin group: ![Image](https://github.com/user-attachments/assets/c160617f-4c57-47ad-9ee4-bbf48960e569) I have also added the flag ```--group-claim-name groups``` to the add-oauth call, and now I am starting to log in (first user after a database wipe) with an unprivileged user... and it shows as if it was an admin :-O! ![Image](https://github.com/user-attachments/assets/aaee6d09-8f28-444a-84c3-eeefa34c5896) Just for the record, there is no other user in the database: ![Image](https://github.com/user-attachments/assets/375c1436-108d-44c4-88e1-324acf2ddb44) So.... what's wrong?

GiteaMirror commented

@flixman commented on GitHub (May 17, 2025):

@techknowlogick @0dragosh with version 1.23.8 the problem is that the first user is set as admin no matter what. There seems to be a (possibly outdated) code block that returns the error we see although no admin is deleted anywhere. I know too little about the architecture to happily remove that part :-/. However, the solution seems to be to add a dummy admin as the first user, and then everything seems to be ok (for now)

	if opts.IsAdmin.Has() {
		if !opts.IsAdmin.Value() && user_model.IsLastAdminUser(ctx, u) {
			return models.ErrDeleteLastAdminUser{UID: u.ID}
		}

		u.IsAdmin = opts.IsAdmin.Value()

		cols = append(cols, "is_admin")
	}

@flixman commented on GitHub (May 17, 2025): @techknowlogick @0dragosh with version 1.23.8 the problem is that the first user is set as admin no matter what. There seems to be a (possibly outdated) code block that returns the error we see although no admin is deleted anywhere. I know too little about the architecture to happily remove that part :-/. However, the solution seems to be to add a dummy admin as the first user, and then everything seems to be ok (for now) ```go if opts.IsAdmin.Has() { if !opts.IsAdmin.Value() && user_model.IsLastAdminUser(ctx, u) { return models.ErrDeleteLastAdminUser{UID: u.ID} } u.IsAdmin = opts.IsAdmin.Value() cols = append(cols, "is_admin") } ```

GiteaMirror commented

@0dragosh commented on GitHub (May 17, 2025):

Sorry for not replying sooner but I am running Forgejo and this seems to be a shared code path. My bad.

@0dragosh commented on GitHub (May 17, 2025): Sorry for not replying sooner but I am running Forgejo and this seems to be a shared code path. My bad.

GiteaMirror commented

@techknowlogick commented on GitHub (May 17, 2025):

Yes, at least one admin user is required.

@techknowlogick commented on GitHub (May 17, 2025): Yes, at least one admin user is required.

GiteaMirror commented

@lunny commented on GitHub (May 17, 2025):

@techknowlogick @0dragosh with version 1.23.8 the problem is that the first user is set as admin no matter what. There seems to be a (possibly outdated) code block that returns the error we see although no admin is deleted anywhere. I know too little about the architecture to happily remove that part :-/. However, the solution seems to be to add a dummy admin as the first user, and then everything seems to be ok (for now)

if opts.IsAdmin.Has() {
if !opts.IsAdmin.Value() && user_model.IsLastAdminUser(ctx, u) {
return models.ErrDeleteLastAdminUser{UID: u.ID}
}
  u.IsAdmin = opts.IsAdmin.Value()

  cols = append(cols, "is_admin")
}

Who can login with that dummy admin account? I don't think it can be simply removed.

@lunny commented on GitHub (May 17, 2025): > [@techknowlogick](https://github.com/techknowlogick) [@0dragosh](https://github.com/0dragosh) with version 1.23.8 the problem is that the first user is set as admin no matter what. There seems to be a (possibly outdated) code block that returns the error we see although no admin is deleted anywhere. I know too little about the architecture to happily remove that part :-/. However, the solution seems to be to add a dummy admin as the first user, and then everything seems to be ok (for now) > > if opts.IsAdmin.Has() { > if !opts.IsAdmin.Value() && user_model.IsLastAdminUser(ctx, u) { > return models.ErrDeleteLastAdminUser{UID: u.ID} > } > > u.IsAdmin = opts.IsAdmin.Value() > > cols = append(cols, "is_admin") > } Who can login with that dummy admin account? I don't think it can be simply removed.

GiteaMirror commented

@flixman commented on GitHub (May 18, 2025):

@lunny Nobody is expected to use that dummy account. Maybe I am looking at this the wrong way, but what I am aiming towards to is: I want to have all the identities provided externally, in this case by Authelia. With my current configuration, when I get to gitea -> sign in, I just get a button to use authelia login (I'd like this to happen without having to click the button, but I think is not possible?) and then have the information about users, groups, etc., sent over by Authelia. All this works, as long as the first user in gitea is an admin.

I guess this should be stated as a requirement somewhere? Having an app relying only on externally provided ids is not that a corner case nowadays.

@flixman commented on GitHub (May 18, 2025): @lunny Nobody is expected to use that dummy account. Maybe I am looking at this the wrong way, but what I am aiming towards to is: I want to have all the identities provided externally, in this case by Authelia. With my current configuration, when I get to gitea -> sign in, I just get a button to use authelia login (I'd like this to happen without having to click the button, but I think is not possible?) and then have the information about users, groups, etc., sent over by Authelia. All this works, as long as the first user in gitea is an admin. I guess this should be stated as a requirement somewhere? Having an app relying only on externally provided ids is not that a corner case nowadays.

GiteaMirror commented

@lunny commented on GitHub (May 18, 2025):

If nobody is admin, how could you maintain the site? I think the best way is keeping at least one user as admin in authelia side?

@lunny commented on GitHub (May 18, 2025): If nobody is admin, how could you maintain the site? I think the best way is keeping at least one user as admin in authelia side?

GiteaMirror commented

@flixman commented on GitHub (May 18, 2025):

@lunny because, in the oauth2 client, I am setting that the users belonging to gitea_admin group are admins. There are admins, it's only that they are not local.

@flixman commented on GitHub (May 18, 2025): @lunny because, in the oauth2 client, I am setting that the users belonging to gitea_admin group are admins. There are admins, it's only that they are not local.

GiteaMirror commented

@wxiaoguang commented on GitHub (Jun 8, 2025):

-> Fix last admin check when syncing users #34649 , also cc @yp05327

@wxiaoguang commented on GitHub (Jun 8, 2025): -> Fix last admin check when syncing users #34649 , also cc @yp05327

GiteaMirror commented

@flixman commented on GitHub (Jun 8, 2025):

@wxiaoguang With your PR, is setting a dummy first admin still required (for the cases in which we'll rely exclusively on OIDC-provided IDs)?

@flixman commented on GitHub (Jun 8, 2025): @wxiaoguang With your PR, is setting a dummy first admin still required (for the cases in which we'll rely exclusively on OIDC-provided IDs)?

GiteaMirror commented